CVE-2017-12949

2017-08-1818:29:03

Google

osv.dev

8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

37.0%

JSON

lib\modules\contributors\contributor_list_table.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parameter to wp-admin/admin.php, exploitable through CSRF.

CPENameOperatorVersion
podlove-publishereq1.10.10-alpha
podlove-publishereq2.3.17
podlove-publishereq2.0.2
podlove-publishereq2.3.15
podlove-publishereq2.4.7
podlove-publishereq2.3.2
podlove-publishereq1.10.13-alpha
podlove-publishereq2.3.14
podlove-publishereq2.3.16
podlove-publishereq1.10.21-alpha

Name	Operator	Version
podlove-publisher	eq	1.10.10-alpha
podlove-publisher	eq	2.3.17
podlove-publisher	eq	2.0.2
podlove-publisher	eq	2.3.15
podlove-publisher	eq	2.4.7
podlove-publisher	eq	2.3.2
podlove-publisher	eq	1.10.13-alpha
podlove-publisher	eq	2.3.14
podlove-publisher	eq	2.3.16
podlove-publisher	eq	1.10.21-alpha